How to Manage API Keys and Webhooks

Give your own server-side code controlled, business-scoped access to KaiCalls data, and push events out to your other systems — without ever sharing a user password.

What This Page Controls

API Keys & Webhooks is for developers and technical operators who want to integrate KaiCalls with their own software. An API key is a credential your backend sends with each request to read data such as agents, calls, and related records. A key belongs to a single business, so it can only reach that business's data — keep keys separate from user logins.

  • Create and manage API keys for a selected business
  • Use keys for programmatic access to agents, calls, and related data
  • Configure outbound webhooks that notify your external systems of events
  • Keep integration credentials fully separate from user passwords

Create an API Key

  1. Go to Dashboard > Settings > API Keys.
  2. Open the API Keys tab.
  3. Select the business the key should belong to. The key is scoped to that business's data only.
  4. Create the key and copy it immediately into your secure secret manager — treat it like a password.
  5. Use the key only from trusted server-side code, never in a browser.

Configure Outbound Webhooks

Webhooks push events from KaiCalls to a URL you control, so your CRM or automation tools can react in real time instead of polling.

  1. Open Dashboard > Settings > API Keys.
  2. Switch to the Outbound Webhooks tab.
  3. Add or update the destination URL for your external system.
  4. Save the webhook configuration.
  5. Trigger a test event, or run the workflow that should fire the webhook, and confirm your endpoint received it.

Security and Rotation

  • Store keys in a secret manager or environment variable, never in source code.
  • Use a different key per integration so you can revoke one without breaking the others.
  • Rotate a key by creating a new one, updating your integration to use it, then deleting the old key — this avoids downtime.
  • If a key may have leaked, delete it right away; deleting a key immediately stops it from working.
  • Have your webhook endpoint serve HTTPS and reject unexpected requests.
Protect keys: Never paste API keys into browser code, public repositories, screenshots, support chats, or customer-facing documentation.

FAQ & Troubleshooting

I lost my key — can I see it again?

For security, a key is shown so you can copy it; if you did not store it, create a new key and delete the old one rather than trying to recover the original.

My requests return an unauthorized error.

Check that you are sending the key correctly, that it has not been deleted, and that you are calling it for the same business the key was created under. A key cannot reach another business's data.

My webhook is not arriving.

Verify the destination URL is correct and publicly reachable over HTTPS, that your endpoint returns a success status, and re-trigger a test event to confirm delivery.

Related

  • Connections — built-in integrations that may remove the need for custom API code
  • Workflows — automate actions that can trigger outbound webhooks
  • CRM — push leads into your CRM without writing code
    How to Manage API Keys and Webhooks | KaiCalls Help